RTU Interface Modules

Transcription

1 User Manual for the HE693RTU900 HE693RTU940 RTU Interface Modules Eighth Edition 03 June 2003 MAN

2

3 MAN JUN 2003 PAGE 3 PREFACE This manual explains how to use the Horner APG RTU Interface Cards for use with GE Fanuc Series PLCs and CEGELEC Alspa 8000 PLCs. Copyright (C) 2003 Horner APG, LLC., 640 North Sherman Drive Indianapolis, Indiana All rights reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form by any means, electronic, mechanical, magnetic, optical, chemical, manual or otherwise, without the prior agreement and written permission of Horner APG, LLC. All software described in this document or media is also copyrighted material subject to the terms and conditions of the Horner Software License Agreement. Information in this document is subject to change without notice and does not represent a commitment on the part of Horner APG, LLC. For user manual updates, contact Technical Support: North America: (317) Europe: (+)

4 PAGE 4 03 JUN 2003 MAN LIMITED WARRANTY AND LIMITATION OF LIABILITY Horner APG, LLC. ("HE-APG") warrants to the original purchaser that RTU Interface Module manufactured by HE -APG is free from defects in material and workmanship under normal use and service. The obligation of HE-APG under this warranty shall be limited to the repair or exchange of any part or parts which may prove defective under normal use and service within two (2) years from the date of manufacture or eighteen (18) months from the date of installation by the original purchaser whichever occurs first, such defect to be disclosed to the satisfaction of HE-APG after examination by HE-APG of the allegedly defective part or parts. THIS WARRANTY IS EXPRESSLY IN LIEU OF ALL OTHER WARRANTIES EXPRESSED OR IMPLIED INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR USE AND OF ALL OTHER OBLIGATIONS OR LIABILITIES AND HE-APG NEITHER ASSUMES, NOR AUTHORIZES ANY OTHER PERSON TO ASSUME FOR HE-APG, ANY OTHER LIABILITY IN CONNECTION WITH THE SALE OF THIS RTU INTERFACE MODULE. THIS WARRANTY SHALL NOT APPLY TO THIS RTU INTERFACE MODULE OR ANY PART THEREOF WHICH HAS BEEN SUBJECT TO ACCIDENT, NEGLIGENCE, ALTERATION, ABUSE, OR MISUSE. HE-APG MAKES NO WARRANTY WHATSOEVER IN RESPECT TO ACCESSORIES OR PARTS NOT SUPPLIED BY HE-APG. THE TERM "ORIGINAL PURCHASER", AS USED IN THIS WARRANTY, SHALL BE DEEMED TO MEAN THAT PERSON FOR WHOM THE RTU INTERFACE MODULE IS ORIGINALLY INSTALLED. THIS WARRANTY SHALL APPLY ONLY WITHIN THE BOUNDARIES OF THE CONTINENTAL UNITED STATES. In no event, whether as a result of breach of contract, warranty, tort (including negligence) or otherwise, shall HE -APG or its suppliers be liable of any special, consequential, incidental or penal damages including, but not limited to, loss of profit or revenues, loss of use of the products or any associated equipment, damage to associated equipment, cost of capital, cost of substitute products, facilities, services or replacement power, down time costs, or claims of original purchaser's customers for such damages. To obtain warranty service, return the product to your distributor with a description of the problem, proof of purchase, post paid, insured and in a suitable package. ABOUT PROGRAMMING EXAMPLES Any example programs and program segments in this manual or provided on accompanying diskettes are included solely for illustrative purposes. Due to the many variables and requirements associated with any particular installation, Horner APG cannot assume responsibility or liability for actual use based on the examples and diagrams. It is the sole responsibility of the system designer utilizing RTU Interface Module to appropriately design the end system, to appropriately integrate the RTU Interface Module and to make safety provisions for the end equipment as is usual and customary in industrial applications as defined in any codes or standards which apply. Note: The programming examples shown in this manual are for illustrative purposes only. Proper machine operation is the sole responsibility of the system integrator.

5 MAN JUN 2003 PAGE 5 Revisions to This Manual This version (MAN ) of the RTU Interface Module User Manual contains the following revisions, additions and deletions: Added Section 1.2: Technical Support. Revised Table 2.2. Revised Figure 3.5.

6 PAGE 6 03 JUN 2003 MAN

7 MAN JUN 2003 PAGE 7 Table of Contents PREFACE...3 ABOUT PROGRAMMING EXAMPLES...4 Revisions to This Manual...5 CHAPTER 1: INTRODUCTION Product Description Technical Support...9 CHAPTER 2: INSTALLA TION Mounting Requirements Power requirements Module Installation Module Configuration Configuration with the Hand Held Programmer Configuration with the PLC Software...13 CHAPTER 3: OPERATION Modbus Protocol Port Selection RS-232 Connections RS-485 Connections Frame Protocol Handshaking DCS Active Detection Front Panel Diagnostic LED s Dial %R (HE693RTU940 only) Use and Configuration of Dial %R Dial %R Example Dial String Call Initialization Supported Modbus Commands Modbus Command Descriptions Read Exception Status Command (RTU Module specifics) Loopback Diagnostics Test Command (RTU Module specifics) Modbus Responses PLC to Modbus I/O Mapping...26 APPENDIX A: ASCII / HEXIDECIMAL TABLE APPENDIX B: SPECIAL DIAL STRING CHARACTERS... 31

8 PAGE 8 03 JUN 2003 MAN NOTES

9 MAN JUN 2003 PAGE 9 CH. 1 CHAPTER 1: INTRODUCTION 1.1 Product Description Congratulations on your purchase of a Horner APG RTU Interface module. The HE693RTU900 is a Modbus slave interface which allows modbus communications with either RS232 or RS485. The HE693RTU940 is equivalent to the HE693RTU900 with the addition of a 14.4k bps modem. The RTU Module allows a Modbus master to access PLC reference data as though it were Modbus I/O. This data may be accessed using standard Modbus commands such as Read / Force Coils and Read / Preset Registers. To access most of the PLC data types with the limited set of Modbus commands, references provided in these commands are subdivided into regions which allow access to a particular data table. Accessible data types are: %M, %I, %Q, %T, %R, %AI, %AQ. Reading and writing data is always allowed. Read and Write packets of up to 2000 discrete or 125 analog values are supported. Message reception LED s and Modbus Diagnostic and Exception commands are also supported to provide easy setup and troubleshooting. The HE693RTU940 has the Report-By-Exception feature. This feature gives the module the ability to originate commands and monitor call status. Configuration of the port type and associated frame protocol parameters is easily accomplished through the Hand Held Programmer or providing the included information of a foreign I/O module definition with PLC configuration software. Both the HE693RTU900 and HE693RTU940 support baud rates of up to 115.2K for RS232 or RS485 in either ASCII or RTU modes. The HE693RTU940 supports a baud rate up to 14.4k for the modem port. Please note that there are limitations in the number of stop bits and parity selections. 1.2 Technical Support For user manual updates, contact Technical Support: North America: (317) Europe: (+)

10 PAGE JUN 2003 MAN CH. 1 NOTES

11 MAN JUN 2003 PAGE 11 CH. 2 CHAPTER 2: INSTALLATION 2.1 Mounting Requirements The RTU Module is designed to plug into any series or CEGELEC Alspa 8000 backplane slot. Please refer to the PLC Installation manual for information on installing the module. 2.2 Power requirements 5VDC 2.3 Module Installation 1. Remove power from the PLC CPU/Rack. 2. Install the module in a free slot. 3. Apply power to the PLC. 4. Configure the communication port parameters with the HHP or PLC configuration software. 5. Select an appropriate %I reference for DCS monitoring. 6. Connect the Modbus master to the appropriate port. 7. Start Modbus master application. 2.4 Module Configuration Before the module is connected to the Modbus Master, it should be configured with the appropriate parameters. You may use either the Hand Held Programmer (HHP) or PLC software to configure the parameters. This module can be used with any CPU but requires a PLC CPU version 5.01 or later to configure. If you are not familiar with the Modbus frame protocol or the RTU Module options, first read chapter 3: Operation Configuration with the Hand Held Programmer 1. Install the RTU Interface module into the PLC. 2. Apply power to the PLC rack. The PLC will perform its power-up diagnostics and a menu will appear on the Hand Held Programmer's display. 3. Enter the following key sequence on the Hand Held Programmer. Display Keystroke Comments 1. PROGRAM <S 2. DATA 4 1. PROGRAM <S 2. DATA MODE 4 Press the MODE key to reach this screen. Press the 4 key, a 4 will appear as the first character in the display. R0: 00 PLC <S KEY CLK : OFF ENTER Press the ENTER key, the display will now show the PLC CPU status.

12 PAGE JUN 2003 MAN CH. 2 Display Keystroke Comments R0: 01 EMPTY <S R0: 01 READ <S READ VRFY Press the DOWN ARROW key until the slot number containing the RTU Interface Module appears following the "R0:". This example assumes the module resides in slot 1, therefore the DOWN ARROW key is only pressed once. Press the READ/VRFY key. R0: 01 RTU9XX <S I08 : I R0: 01 RTU9XX <S I08 : I ENTER 1 ENTER Press the ENTER key, this will cause the PLC to "read" the RTU Interface Module. The model number of the module will be displayed. The PLC now prompts for the starting address of the 8 %I bits. Pressing the 1 key will cause the %I registers to be mapped from %I0001 to %I0008. Pressing the ENTER key will cause the PLC to accept the %I address. R0: 01 RTU9XX <S Slave Addr : 1 Pressing the RIGHT ARROW key will cause the next configuration parameter to be displayed. All of the additional parameters can be modified by entering the numeric data or pressing the +/- key then pressing enter. R0: 01 RTU9XX <S Port Type : RS232 +/- ENTER These additional parameters are described below and in greater detail in chapter 3.

13 MAN JUN 2003 PAGE 13 CH. 2 Additional Parameters Slave Address Port Protocol Baud * Parity Stop Bits * 1, 2 Handshake Modem Turn-Around Time Table 2.1 Limits / Options (Hexadecimal values) RS232, RS485, Modem ASCII, RTU, ASCII-A, RTU-A K (all common rates) None, Odd, Even None, Software, Hardware, Multi-drop, Radio Modem None, 0.25, 0.5, 0.75, 1.0 Second DCS Time-out 0-12 Seconds (off if time = 0) * Certain fields will generate a CNF_ERR on the Hand Held Programmer if they are invalid for the mode of operation Configuration with the PLC Software 1. Install the RTU Interface module as described in the PLC documentation. 2. Execute the PLC Configuration Software. 3. Enter the Configuration Package from the Main Menu <F2>. 4. Select the proper folder. 5. Choose I/O Configuration from the Configuration Menu <F1>. 6. Cursor over to the slot containing the RTU Interface module. 7. Select Other <F8> and Foreign <F3>. 8. The following screen should be displayed.

14 PAGE JUN 2003 MAN CH Cursor down to the %I starting address and enter the starting address for the 8 %I bits. 10. Cursor down to the %I size and enter the number of %I bits for the RTU Interface Module (8). 11. Repeat steps 9 and 10 for the %Q starting address and size. 12. Cursor over to byte 1 and enter a 1 ( ). This signifies to the PLC that the RTU Module is an intelligent module. 13. Bytes 2 and 3 are used for the location of the dial number for the HE693RTU940 (Section 3.7). Note: This only applies to the HE693RTU Bytes 2 through 12 should be setup according to Table 2-2 on the following page. 15. All remaining bytes should be set to 0. Table Byte Parameter Setting 2 and 3 Dial %R The Dial %R reference must be divided into a high (byte 3) and low (byte 2) and then converted into the appropriate binary number which will be placed in byte 2. See page 18 for more detail. 4 Slave Address Port RS232 = 0, RS485 = 1, Modem = 2 6 Protocol ASCII = 0, RTU = 1, ASCII-A = 2, RTU-A = 3 7 Baud Rate 300 = 0, 600 = 1, 1200 = 2, 2400 = 3, 4800 = 4, 9600 = 5, = 6, = 7, = 8, = 9, = 0Ah, = 0Bh 8 Parity None = 0, Odd = 1, Even = 2 9 Stop Bits 1 = 0, 2 = 1 10 Handshake None = 0, Software = 1, Hardware = 2, Multi-drop = 3, Radio Modem = 4 11 DCS Time-out (seconds) Modem TAT (seconds) 0 = 0, 0.25 = 1, 0.5 = 2, 0.75 = 3, 1.0 = 4

15 MAN JUN 2003 PAGE 15 CH. 3 CHAPTER 3: OPERATION 3.1 Modbus Protocol The Modbus protocol uses a Master/Slave protocol that can support a common bus of one master and up to 247 Modbus Slaves. However, note that the media (RS -485) typically used for Modbus is limited to 32 units. As a Modbus slave, the RTU Interface Module must be assigned a unique address. Address zero is reserved for broadcasting a message to all units. The RTU Interface Modules will process broadcast messages but no response packet will be returned. The Modbus master will issue a command to start the transaction. The command will contain a unit address specifying the slave which should respond. The slave will process the command and will return a single response. Message integrity is assured through use of checksums included in the messages. The Slave ignores all messages which have invalid checksums and assumes the Master has received any responses sent. It is the Master node application s responsibility to provide time-out and retry provisions. Before the RTU Modules will respond appropriately to Modbus commands it must be configured to the frame protocol used by the other unit on the common line. This includes items such as the media (RS- 485, RS-232, or modem), frame protocol such as (ASCII, RTU, ASCII-A, or RTU-A), baud rate, parity, stop bits, and, finally, optional handshaking. 3.2 Port Selection The user may select either the RS-232, RS -485, or modem to use for communications through the PLC software configuration. The pinouts for the RS -232 and RS-485 ports are shown below. The pinout for the modem port is on page 14. Table Pin RS-232 Port Pin # Signal Name Direction 1 [DCD] Always High Output 2 [TXD] Transmit Data Output 3 [RXD] Receive Data Input 4 No Connection N/A 5 [GND] Signal Ground N/A 6 [DSR] Always High Output 7 [CTS] Clear To Send Input 8 [RTS} Request to Send Output 9 [RI] Always High Output Table Pin RS-485 Port Pin # Signal Name Direction 5 [PWR] 5 VDC Power N/A 6 [RTS-] Request To Send Output 7 [GND] Signal To Ground N/A 8 [CTS+] Clear To Send Input 9 [TERM] Termination Input 10 [RXD-] Receive Data Input 11 [RXD+] Receive Data Input 12 [TXD-] Transmit Data Output 13 [TXD+] Transmit Data Output 14 [RTS+] Request To Send Output 15 [CTS-] Clear To Send Input

16 PAGE JUN 2003 MAN CH. 3 Figure 3.1 RS pin Connector Figure 3.2 RS pin Connector RS-232 Connections Figure 3.3 RTU900 RS-232 to Telephone Modem Wiring Figure 3.4 RTM700/705 RS -232 to Horner APG RTU900 RS-232 (Port 1) Wiring

17 MAN JUN 2003 PAGE 17 CH RS-485 Connections - 0V 7 7 0V 7 0V Figure 3.5 RTM700/705 RS -485 to Horner APG RTU900 RS-485 Wiring (Four-Wire)

18 PAGE JUN 2003 MAN CH. 3 Figure 3.6 RTM700/705 RS-485 to Horner APG RTU900 RS-485 Wiring (4-Wire Multi Drop) Table 3.3 Pin Out Pin # Signal Name 1 No Connection 2 Ring 3 Tip 4 No Connection Figure 3.7 Standard RJ-11 Connector Activity on these ports may be monitored by the LED s on the front panel. See Front panel diagnostic LED s section 3.7.

19 MAN JUN 2003 PAGE 19 CH Frame Protocol RTU mode sends each byte of information in binary form thus requiring 8-bits of transmitted data. ASCII mode divides a byte of information into two nibbles and transmits each as a 7-bit hexadecimal character. The ASCII mode uses twice as many transmitted characters; however, debugging with printable ASCII characters can be much easier. Therefore, setting the mode to either ASCII or RTU indirectly sets whether the data size is 7 or 8 bits. The second (alternate) set, ASCII-A AND RTU-A, selects a new Modbus address to PLC address mapping (see pages 20-22). In addition to the mode, the user must also know the baud rate, parity and the number of stop bits used by the other units on the common line. All these parameters are changeable with PLC software configuration. The following frame protocol combinations are not completely interchangeable on the HE693RTU900 or HE693RTU940 and should be considered in selecting the Modbus master s frame protocol. See the highlighted paragraph below. The configuration ASCII mode, 1 Stop Bits and No Parity will actually require 2 stop bits before the RTU900 will accept characters. The configuration RTU mode, 2 Stop Bits and either Even or Odd Parity will actually generate only 1 stop bit which may or may not affect the application s reception of characters. 3.4 Handshaking The HE693RTU9x0 provides five different handshaking modes to provide for multi-drop configurations or to limit data flow back to masters with hardware/software limitations. NONE - SOFTWARE - HARDWARE - MULTI-DROP - RADIO MODEM - No handshaking is provided. If the slave returns data at a rate and value the master is unable to handle, data will be lost. If the RS -485 is used, the transmit driver will be enabled continuously. The RTU Interface module suspends sending data on the reception of a XOFF character. Transfer will thereafter continue on the reception of a XON character. (This mode should not be used with RTU mode). The RTU Interface asserts RTS continuously to sender. CTS is monitored during RTU transmissions. If the master drops the CTS line low, the RTU will suspend the transfer. Transfer will thereafter continue when the master raises the CTS line. Multi-drop handshaking is required for RS-485 multiple unit (either single or half duplex) or single unit half-duplex configurations. This enables the transmit driver only when the RTU is transmitting. For RS-232, this mode controls the CTS signal for compatibility with RS232-to-RS485 converters which can be operated in a half-duplex mode. When multi-drop handshaking is enabled, no other handshaking is available. Similar to hardware handshaking with the exception that RTS is only asserted when the RTU has data to send. Thereafter, the RTU sends or suspends data transfer based on the CTS line. The radio modem mode also provides an optional modem turn-around-timer (TAT). If the modem does not respond to the RTS line within a specified period,

20 PAGE JUN 2003 MAN CH. 3 then the transmit buffer is flushed, RTS is dropped and the frame is lost. TAT is enabled by specifying in the confi guration one of the (.25,.50,.75 and 1.00 Second) time intervals. Setting the time interval to NONE disables the TAT. 3.5 DCS Active Detection The RTU Interface Module provides the capability to optionally monitor the activity from the Modbus master. Should that activity drop off, a bit is set in both the configured %I reference (Bit 0) and the Modbus exception status byte; furthermore, the DCS LED will begin to flash at a 1 second rate. This provides a method for the CPU, maintenance operator and the master to determine if the master is functioning properly. To enable this feature, set the DCS configuration entry to the amount of time you wish the RTU Module to wait after the last communications frame was sent before setting the indication bit. Th e time-out value is limited to 1 through 12 Seconds. Setting the Time-out value to zero disables this feature. The %I reference (Bit 0) and the DCS LED are reset immediately when master communications is restored. The bit in the Exception status byte remains set until after the Modbus Read Exception command is received. In instances where the HE693RTU940 is used in conjunction cellular phones, the baud rate should be set to 300 to avoid data corruption due to noise and the DCS will need to be adjusted according to message size. Configuring the DCS to a setting of 5 or more should eliminate any data errors. 3.6 Front Panel Diagnostic LED s RXB RXA TXB TXA DCS Figure 3.7 Front Panel Diagnostic LEDs RXA, TXA will flicker when there is activity on the associated lines for the RS-232 port. If the RS-485 port is active, RXB, TXB will flicker when there is activity on the associated lines for that port. If the modem port is selected, RXA will flicker indicating off-hook activity and TXA will flicker indicating an incoming call. If DCS has not timed out or is not enabled, the DCS LED will momentarily light when a valid Modbus message has been received and is being processed by the RTU Interface Module. If the RX light is flashing and the DCS is not, this generally indicates that the frame protocol is incorrect. If DCS is enabled and timed out, this LED flashes at a constant 1 Second rate. 3.7 Dial %R (HE693RTU940 only) The Dial %R parameter is the reference address that specifies the registers that are used to store the phone number (dial string) the user wishes to dial. This setting varies in the number of registers used according to the length of the dial string. The registers used for the Dial %R parameter must not

21 MAN JUN 2003 PAGE 21 CH. 3 conflict with the use of any other module. Discrete input (%I) and output (%Q) registers are used to monitor status and initiate calls, respectively Use and Configuration of Dial %R The Dial %R is the last parameter using the HHP and the second and third Byte when configuring with the PLC Software. Using the HHP, the Dial %R parameter is entered in decimal form. Using the PLC Configuration Software, the Dial %R setting must be divided into a high (Byte 3) and a low (Byte 2) Byte value and then converted to the appropriate binary format. Once the value has been converted to binary form, it is placed in Byte 2 of the configuration. The number of registers used by the Dial %R parameter depends upon the length of the number the user wishes to dial. Each register contains a maximum of up to two characters. For example, if the user is calling a 7-digit number, then 4 consecutive registers are used. The 8 %I registers configured give the status of the modem. Of 8 %Q registers configured, only the first is used. %Q1 is used to initiate the call. A high transition (1) initiates the call. A low transition (0) clears the status register. The following page contains a detailed list of the status and control registers and their uses. Also see the Dial %R Example section for help. Table 3.4 Status Bits %I BITS %I1 DCS time-out %I2 Bad string or modem rejection %I3 Local busy %I4 Remote busy %I5 No dial tone %I6 No answer %I7 No carrier %I8 Connection complete Table 3.5 Control Bits %Q BITS %Q1 Initiates call %Q2 Not used %Q3 Not used %Q4 Not used %Q5 Not used %Q6 Not used %Q7 Not used %Q8 Not used Dial %R Example This example is designed to originate a call from the HE693RTU940, taking advantage of the Report-By- Exception feature. The Dial %R parameter is configured beginning at %R150. The telephone number that is called is The call is being initiated from within a building that requires the use of a '9' at the beginning of telephone number to access outside calls. Because of the local exchange needed to access outside lines, a delay must be entered to allow for proper modem response. Any time a local exchange takes place, a delay must be entered. The complete number that must be entered beginning at %R150 is 9, The Dial %R parameter is the last configuration setting using the HHP. The setting is directly entered at the prompt. Using the HHP, the dial string can only be entered in hexadecimal format. Following the example above, if the Dial %R is to be configured at %R150, then the value 150 is entered at the parameter prompt. If using the PLC Configuration Software, the Dial %R value of 150 has to be converted from ASCII (decimal) to binary format and entered in Byte 2. Following the example, If ASCII 150 = Binary , then Byte 2 =

22 PAGE JUN 2003 MAN CH Dial String The dial string is a group of characters used by the Dial %R command to initiate a call. The example telephone number being dialed is 9 characters in length. Each register holds a maximum of two digits. Therefore, 5 registers are needed for the dial string (%R ). Two ways are used to enter the dial string using the PLC Programming Software: ASCII and hexadecimal. The ASCII field must be selected from the Programming menu and quotation marks have to be used before and after each pair of dial string values entered. For example, if the user was entering the values 9 and, into %R150, then the process would be: 1. From the PLC Programming Software, select 'Reference Tables' (F2). 2. Cursor to each %R that will contain dial string characters and select 'ascii' (F7) format. 3. Select the %R150 and type "9," (include quotation marks). Strike the 'Enter' key to input the values to the appropriate registers. Follow this process for the remaining dial string. If entering the dial string in hexadecimal format using the PLC Programming Software, then select 'hex' (F5) and convert the group of registers to a hexadecimal format. Each dial string character would then be entered according to it's ASCII equivalent, no quotation marks needed. See Appendix A on page 22 for an ASCII/HEX conversion chart. Using the HHP, the dial string can only be entered in hexadecimal format. Simply go to %R150 and enter the dial string in the consecutive registers in hexadecimal format. See Tables 3-6, 3-7, and 3-8 for Configuration Examples and Appendix B on page 23 for Special Dial String Characters. Note: The dial string is entered into the PLC Programming Software and the Hand Held Programmer from right to left. Example: The number "1" followed by "2" would be entered into these two devices, "3231." Dial %R Table 3.6 Configuration Possibilities PLC Programming HHP Dial String Software ASCII Hexadecimal Hexadecimal ,, 2C 2C Table 3.7 Dial %R for PLC Configuration Software %R154 %R153 %R152 %R151 %R150 Decimal ,9 Hexadecimal C39

23 MAN JUN 2003 PAGE 23 CH. 3 Table 3.8 Dial %R for HHP (hex) %R154 %R153 %R152 %R151 %R C Call Initialization Once the dial string has been entered into the appropriate registers, then the first discrete output (%Q) configured for the HE693RTU940 is toggled to initiate a call. Entering a '1' into the register calls the dial string at the Dial %R reference, in our previous example, %R150. Entering a '0' into the register clears the status register and disconnects the call. Once the %Q has been set high and the telephone number dialed, the Report-By-Exception command is sampled to see if the call was accepted. If the call was accepted, the Master will issue a Modbus request for the station ID. The Master will then request data at a predetermined location. When the Master hangs up, the local modem will drop the Carrier Detect (DCD) and the slave will set status OK (%I8). The connection is broken each time a command is completed. The modems do not stay connected. 3.8 Supported Modbus Commands Table 3.9 supported Modbus Commands Code Meaning I/O Unit Min Max Duplicates 01 Read Coil Status I Bit Read Input Status I Bit [01]* 03 Read Holding Registers I Word Read Input Registers I Word [03]* 05 Force Single Coil O Bit Preset Single Register O Word Read Exception Status I Bit Loopback Diagnostic Test N/A N/A N/A N/A 15 Force Multiple Coils O Bit Preset Multiple Registers O Word * Indicates that this command duplicates that function code listed. The reference accessed is instead determined by the specified reference (Address) Modbus Command Descriptions The format of the commands are as in the Modbus specification with the exception of reference (Address) field. See Section 3.10: PLC to Modbus I/O Mapping for more information. It is not in the scope of this document to describe each command in detail. For more specific information on the standard Function Codes, Sub-function Codes and exception responses, refer to the Gould Modbus Protocol Reference Guide (PI-MBUS-300 Rev. B) published by Gould, Inc. or "GE Fanuc Series 90 PLC Serial Communications User's Manual" (GFK-0582B).

24 PAGE JUN 2003 MAN CH. 3 RTU Module specific information is described on the following page for the Read Exception Status and the Loopback Diagnostic Test Read Exception Status Command (RTU Module specifics) The Modbus Read Exception Status command returns a byte value which indicates the status of the RTU Interface Module. The following defines each bit in the status byte. Table MTE MRS PLH PLL I/O FLTS PLC FLTS I/O ENAB RUN MTE MRS PLH/PLL I/O FLTS PLC FLTS I/O ENAB RUN DCS timeout has occurred; cleared after the Read Exception Status command done. CPU/RTU Interface Module has been reset since last Read Exception Status command. 2-bit designation of privilege level. Level 1 indicates privilege to only read data tables. Level 2 indicates privilege to read and write data tables. Indicates CPU has I/O faults in the fault table. Indicates CPU has CPU faults registered in the fault table. Indicates CPU has I/O enabled. Indicates CPU is in run mode Loopback Diagnostics Test Command (RTU Module specifics) The RTU Module supports the following standard Diagnostic Codes for Loopback Diagnostics Test command: Code Table 3.11 Loopback Diagnostic Test Commands Meaning 00 Return 2 byte data field (loopback test) 01* Reset RTU Module 02* Return 16-bit RTU Module diagnostic register (last major error) 04 Force Slave into listen only mode 10 Clear counters and diagnostic register 11 Return 16-bit bus message count 12 Return 16-bit bus invalid error check count 13 Return 16-bit Bus exception count 14 Return 16-bit Slave message count 15 Return 16-bit Slave no response count *RTU Module Specific Diagnostic Codes [01 and 02]:

25 MAN JUN 2003 PAGE 25 CH. 3 [01] Reset RTU Module only resets listen-only-mode if it was set earlier with diag code 04. [02] Return Diagnostics register returns the major error code if a failure-in-device exception response is returned. 3.9 Modbus Responses If a failure-in-device exception response is returned, the application should issue the Loop-back Diagnostics Test with diagnostic code 02 command to return the RTU Interface Module diagnostics register. The following returned values are typical: Invalid Privilege. The CPU has a password assigned for writing to the Data tables. See Passwords SR Queue Full. The CPU service requester is overloaded, reduce CPU communications traffic SR Queue Ovfl. The CPU service requester is overloaded, reduce CPU communications traffic. Frequent occurrences of any other diagnostic word value indicates an internal error and should be reported to Technical Support. Modbus Commands and Responses consist of message frames which contains the following information: Slave Address Function Code Data Error Check Code If a Modbus command s address matches a Modbus Slave s address and the received data is validated by the Error Check Code, then that slave executes the indicated function. The slave will also issue a response based on that function. Alternately, if a Modbus Command s address is zero (broadcast), all Modbus slaves will execute the command; however, no slave will issue a response. Note that only Function Codes of 5, 6,15,16, 72 and some sub-functions of Function 8 may be broadcast in this way. A normal response will contain the same slave address and function code as the request; however, the individual data field(s) may vary according to the function. If the Modbus slave detects an error either internally or in the command parameters, the command will not be executed and the function will return an Exception Response. An exception response is indicated by setting the high bit in the returned function code and returned data byte describing the exception. The RTU Module supports the standard Exception codes listed below: Code Name Meaning Table 3.12 Standard Exception Codes 01 Illegal function Invalid command function was sent 02 Illegal data address Invalid reference, or size exceeded table bounds 03 Illegal data value Not valid data for a particular reference 04 Failure in device See Loopback Diagnostic Test command for details

26 PAGE JUN 2003 MAN CH PLC to Modbus I/O Mapping The Modbus commands which read and write to data tables require a reference (starting point) and, in some cases, the number of points. The Modbus command reference provided and the PLC data table element accessed by the RTU module in the PLC are not necessarily equal as described below. Originally, the Modbus protocol was only meant to access 4 different data tables with limited writing of data. The RTU module expands these limitations by performing reference mapping. The RTU module contains a map of PLC data tables and assigns a range of associated Modbus references to each data table. Table 3.13 Discrete Data Accesses For Reads Read Input Status [single or multiple] Read Coil Status [single or multiple] For Writes Force Single Coil Force Multiple Coils Modbus Reference Selection PLC Reference Modbus Reference %M FFFH %I A000 A7FFH %Q C000 C7FFH %T E000 E0FFH For Reads For Writes PLC Reference Table 3.14 Analog Data Accesses Read Holding Register [single or multiple] Read Input Register [single or multiple] Preset Register Preset Multiple Registers Modbus Reference Selection Modbus Reference %R EH %AI A000 -= A7FFH %AQ C000 C1FFH %PWL N/A F000H Therefore, the user can access more than one PLC data table with a single Modbus command by simply changing the reference. The tables above describe the sub-divided regions of the Modbus reference to access the appropriate data table.

27 MAN JUN 2003 PAGE 27 CH. 3 For example - To read %AQ20... Use Modbus Read Holding Register with reference: %AQ start - C000h offset 20-1 = 19 (13h) - 13h - C013h Each model of the PLC CPU contains a different maximum number of points for each data table. During initialization of the RTU module, the CPU is interrogated for the size of each of its data tables. Should a Modbus reference and Table 3.15 Discrete Data Access Map Mode (A)lternate Modbus Command Supported PLC Reference (Decimal) Modbus Reference (Hex) Conventional Modbus Addressing (Decimal) Read Input Status (2) %I FF %Q FF Read Coil Status (1), Force Single Coil (5), Force Multiple Coils (15) %M FFF %T Modbus Command Supported Table 3.16 Analog Data Access Map Mode (A)lternate PLC Reference (Decimal) Modbus Reference (Hex) Conventional Modbus Addressing (Decimal) Read Analog Input (4) %AI FF Read Holding Register (3), Preset Single Register (6), Preset Multiple Registers (16) %R FFF %AQ

28 PAGE JUN 2003 MAN CH. 3 NOTES

29 MAN JUN 2003 PAGE 29 APPENDIX A APPENDIX A: ASCII / HEXIDECIMAL TABLE The following is a list of the ASCII (American Standard Code for Information Interchange) character set. DEC HEX Character DEC HEX Character DEC HEX Character 00 00H NULL 44 2CH 88 58H X 01 01H SOH 45 2DH H Y 02 02H STX 46 2EH. 90 5AH Z 03 03H ETX 47 2FH / 91 5BH [ 04 04H EOT 48 30H CH \ 05 05H ENQ 49 31H DH ] 06 06H ACK 50 32H EH ^ 07 07H BELL 51 33H FH _ 08 08H BS 52 34H H 09 09H HT 53 35H H a 10 0AH LF 54 36H H b 11 0BH VT 55 37H H c 12 0CH FF 56 38H H d 13 0DH CR 57 39H H e 14 0EH SO 58 3AH : H f 15 0FH SI 59 3BH ; H g 16 10H DLE 60 3CH < H h 17 11H DC1 61 3DH = H i 18 12H DC2 62 3EH > 106 6AH j 19 13H DC3 63 3FH? 107 6BH k 20 14H DC CH l 21 15H NAK 65 41H A 109 6DH m 22 16H SYN 66 42H B 110 6EH n 23 17H ETB 67 43H C 111 6FH o 24 18H CAN 68 44H D H p 25 19H EM 69 45H E H q 26 1AH SUE 70 46H F H r 27 1BH ES H G H s 28 1CH FS H H H t 29 1DH GS 73 49H I H u 30 1EH RS 74 4AH J H v 31 1FH US 75 4BH K H w 32 20H SPACE 76 4CH L H x 33 21H! 77 4DH M H y 34 22H 78 4EH N 122 7AH z 35 23H # 79 4FH O 123 7BH { 36 24H $ 80 50H P 124 7CH 37 25H % 81 51H Q 125 7DH } 38 26H & 82 52H R 126 7EH ~ 39 27H 83 53H S 127 7FH DEL 40 28H ( 84 54H T 41 29H ) 85 55H U 42 2AH * 86 56H V 43 2BH H W

30 PAGE JUN 2003 MAN APPENDIX A NOTES

31 MAN JUN 2003 PAGE 31 APPENDIX B: SPECIAL DIAL STRING CHARACTERS Dial the Number Immediately Following this Command Where n = digits 0 to 9, the symbols # and *, and may include the dial modifiers listed below. The modem will dial the number specified in the manner determined by the dial modifiers. The dial modifiers may appear anywhere within the dial string with the exception of the ; modifier which must appear at the end of the string. Dial Modifiers: P Pulse dial T Tone dial, Wait for quiet before dialing Example: P9T713, ; In this example the modem pulse dials a 9-digit number, waits for a dial tone, then tone dials the digits 713. It then dials the number Finally, the modem returns to the command mode after the final digit has been dialed. The P modifier causes the modem to pulse or rotary dial at a fixed rate of 10 pulses per second. The T modifier causes the modem to dial using DTMF (Dual-tone multifrequency) signals (the same as those used by touch-tone telephones). The "," modifier causes the modem to pause. When dialing a long distance service, for example, the modem must first dial the local access number, then pause long enough for the services dial tone. The "," is also useful when dialing from a PBX system where considerable time may elapse between requesting and getting a secondary dial tone or "outside" line. modifier causes the modem to wait for 3 seconds for one or more rings followed by 5 seconds of silence before processing the next symbol in the dial string. This is useful when accessing systems that do not provide a dial tone.

32 PAGE JUN 2003 MAN NOTES